CVE-2026-35239

OVERVIEW: CVE-2026-35239 is a denial-of-service vulnerability in Oracle MySQL Server affecting versions 8.0.0-8.0.45, 8.4.0-8.4.8, and 9.0.0-9.6.0. The vulnerability exists in the Server DML component and allows attackers to cause database crashes or hangs, completely disrupting service availability. SEVERITY: The vulnerability carries a CVSS 3.1 score of 4.9 (Medium) and requires high privilege credentials with network access to exploit. The attack vector is network-based with low complexity, and no user interaction is required. However, impact is limited to availability, with no risk to confidentiality or integrity of data. The attack can be executed via multiple protocols, increasing the number of potential entry points. EXPLOITATION STATUS: There is currently no evidence of active exploitation in the wild. The EPSS score of 0.00034 indicates very low real-world exploitation probability, and this vulnerability has not been added to the Known Exploited Vulnerabilities catalog. Community attention remains minimal, making this a lower-priority concern compared to publicly exploited vulnerabilities, though organizations running affected MySQL versions should still apply patches as part of regular maintenance cycles.